This is the destination-side counterpart to cienaCesAclRuleMatchSrcMacAddr, switching on matching against the destination MAC address of a frame rather than its source, again making the paired cienaCesAclRuleDstMacAddr and cienaCesAclRuleDstMacAddrMask fields meaningful only when this is true. An admin uses destination-MAC matching when the concern is which device traffic is headed toward rather than where it came from, for example restricting which frames are allowed to reach a specific sensitive piece of equipment identified by its known hardware address. For example, an admin protecting an isolated management appliance might write a rule matching only on destination MAC to allow traffic addressed to that specific device while a separate rule handles everything else.